4 ms·
It might be true, but assigning CVE just because someone thinks that some API is not secure enough in some random library looks very strange to me. I understand
by vbezhenar 4y ago
It might be true, but assigning CVE just because someone thinks that some API is not secure enough in some random library looks very strange to me. I understand that it's similar to log4shell vulnerability in that regard, but log4j was much more popular than this commons-text library. I'm Java developer and I used commons libraries many times, but I never heard about this particular library so I'm curious where that particular API is used.
- MattPalmer1086 4y agoRenote code execution is about as serious as you can get. Any API that could result in that unintentionally should have a CVE assigned to it. Vulnerabilities are not bugs. They are vulnerabilities. They often arise from bugs, but not always.